Privacy Policy

1. Introduction

Hashmi Mart is a grocery delivery app (a Progressive Web App) serving households in Lahore, Pakistan. This Privacy Policy describes the information we collect when you use the app or this website, how we use it, and the rights you have over it.

By creating an account or using the app, you agree to the practices described in this policy. If you do not agree, please do not use the service.

2. Who we are

Hashmi Mart operates the Hashmi Mart app and this website. The app is built on Supabase (authentication, database, file storage and real-time features) and is hosted on Vercel.

Operator details placeholder — the legal entity name and registered address will be added here when confirmed.

3. Information we collect

We collect only the information needed to run the service. We do not collect advertising identifiers and we do not profile you for advertising.

Account information

• Email address and password — required to create an account. Passwords are stored by Supabase Auth as salted, hashed values; we never see or store your plain-text password.
• Full name and phone number — provided when you sign up, stored in your profile and used for delivery and support contact.
• Account-related emails only: a confirmation email when you sign up and a password reset email if you request one. We do not send marketing email or SMS.

Order information

• Your name, phone number, delivery city, society and delivery address, the items and quantities you order (including a snapshot of each item's price and unit), the order total, and your payment method choice — Cash on Delivery or JazzCash.
• Order status and history, including estimated delivery time.
• We do not collect or store card numbers. Cash on Delivery is paid in person and JazzCash payments are settled outside the app.

Direct orders & voice orders

• When you use Direct Order, we collect the delivery address and the details you provide about what you need.
• When you record a voice order, your voice note is uploaded to our secure storage so our team can listen to it and fulfil your order. Order voice notes are kept only as long as needed to process your order.

Support and communication

• Chat messages you send through the in-app support chat (including conversations with the AI assistant and with store staff).
• Voice notes you record in support chat, which are transcribed by the assistant and then deleted immediately — only the text transcript is kept.
• Any messages you send us through the website or support chat.

In-app notifications

• Order status updates are shown as in-app notifications only. The app does not use push notification services.

Device and technical information

• Basic technical data such as IP address, browser and device type, and app version, collected by our hosting providers (Supabase and Vercel) for security and operation.
• We do not run third-party analytics or advertising trackers on the app or website. If analytics are added later, this section will be updated.

Stored on your device

• Your shopping cart, wishlist, a cached copy of the product catalogue, your session identifier and theme preference are stored in your browser's local storage.
• Supabase stores your login session locally so you stay signed in. This data is cleared from your device when you log out.

4. How we use your information

• To create and manage your account and keep you signed in.
• To process and deliver your orders, including contacting you about delivery.
• To listen to and fulfil voice orders you send us.
• To provide support through the AI assistant and store staff, including transcribing voice notes so they can be answered.
• To show you in-app notifications about your orders.
• To keep the service secure and operating correctly.

5. Legal basis

Legal basis placeholder — the operator will confirm the applicable data protection law and legal grounds (contract performance, legitimate interest, consent) here. In practice, we process your data to provide the service you asked for, to comply with legal obligations, and to protect our legitimate interests.

6. Data sharing & third-party services

We do not sell your personal information. We share data only with the services required to operate the app, and only for the purposes described in this policy:

• Supabase — authentication, PostgreSQL database, file storage (product images, order voice notes, chat audio) and real-time features. Data is protected by row-level security so you can only access your own data.
• Vercel — hosting of the app and this website, including the serverless functions that power support chat and voice search.
• Groq — powers the AI support assistant and transcribes voice notes. Chat messages and audio may be sent to Groq to generate a response; audio is deleted after transcription.
• Unsplash, Pexels and Pixabay — used by store staff to search for product images in the admin dashboard. Your personal data is not shared with these services.
• JazzCash — payments are arranged manually by the store; the app itself does not transmit payment data to JazzCash.
• Google Fonts — fonts are loaded from Google's servers to display the website; no personal data is involved.

7. Cookies & local storage

The app and website do not use advertising or tracking cookies. We use browser local storage to keep you signed in and to remember your cart, wishlist, cached catalogue and theme preference. This data stays on your device and is not used for advertising.

8. Data security

We protect your data with industry-standard measures: encrypted connections (HTTPS), Supabase's database security features including Row Level Security (RLS) so users can only access their own data, and restricted access to administrative accounts. Voice notes are stored in private storage buckets and removed as soon as they are no longer needed. No method of transmission or storage is 100% secure, but we work to protect your information.

9. Data retention

We keep your personal data only as long as needed to provide the service and meet legal obligations. The app enforces these retention periods automatically:

• Support chat messages and chat voice notes: removed automatically after 24 hours by a daily cleanup job. Voice notes sent to the support assistant are deleted immediately after they are transcribed — only the text transcript is kept.
• Voice search audio: deleted automatically right after it is transcribed into a search query.
• Order voice notes: kept only as long as needed to fulfil and complete your order.
• Product images: kept while the product is listed in the store.
• Account and order records: retention period placeholder — the operator will confirm how long account and order records are kept for tax and accounting purposes.

10. Data deletion

You can delete your account at any time. When you do, we remove your account, profile, wishlist, notifications, chat history, uploaded voice notes and personal data from our systems, except for records we are legally required to keep (such as order records for accounting purposes).

To request deletion, use the Delete Account page on this website, or contact us and we'll process the request for you.

11. Your rights

You have the right to access the personal data we hold about you, to ask for corrections, to request deletion, and to object to or restrict certain processing. Rights placeholder — specific rights under the applicable law of Pakistan will be confirmed here. To exercise any of these rights, contact us using the details below.

12. Children's privacy

Hashmi Mart is intended for adults shopping for their household. It is not directed at children, and we do not knowingly collect personal information from children. Age threshold placeholder — to be confirmed to match applicable law. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page will always show the latest revision, and significant changes will be communicated through the app.

14. Contact

Questions about this policy or your data? Contact us at:

• Phone: +92 310 4198984
• Lahore, Pakistan — full operator address to be added here.